Risk Assessment and Compliance Managament

Marketplace Drivers

• Regulatory compliance such as Sarbanes-Oxley, especially given tight deadlines.

• The move towards Enterprise Risk Management.

• Need to be more creative in the identification of risk and development/deployment of mitigation strategies.

• Expense of fraud from financial, company reputation, and morale perspectives.

• The move to control and/or prevent control gaps rather than reacting to them as they occur.

Benefits

• Ability to seamlessly access enterprise data through a single, easy-to-use interface.

• Automates the process to make the compliance effort more efficient.

• Anonymous participation allows “difficult” issues to be surfaced without fear of recrimination.

• Moves compliance work from stale written documentation (that is difficult to search and analyze) into a robust data reporting structure.

• Role-based user access and security can be established throughout the application.

• Quickly reports changes in control structure, progress to date in maintaining compliance, and highlight issues for management’s attention.

• Assists in the alignment of people, processes, and technologies based on well documented and communicated policies.

• Facilitates prompt disclosure of any identified issues.

• Helps document decisions and accelerate their ability to make higher quality decisions with multiple inputs.  

• Automated routing of tasks (workflow) based on the lifecycle of a particular risk/control.

• Provide an opportunity to rethink business processes when entering them into the database.

• Benchmarks risks and controls across the organization.

• Allows for a real time compliance assessment across the entire organization when business processes are constantly in flux.

• Focuses testing on the most risk prone areas of the organization using the risk data store as an assessment tool.

• Reduces organizational fraud.

• Facilitates the move to ongoing sustainable and repeatable processes, as well as, organization-wide risk management practices.

Vendor Selection Considerations

• Performance

• Reputation and Experience

• Stability

• Language independence

• Customer support

• Pre-loaded risk and control libraries

• Integration between all the different features required to satisfy SarbOx and audit requirements

• Scalable database

• Interoperability with existing computer architecture

• Ease of use

• Price

• Implementation and support services

• Simple, common sense methodology with integrated training.